Live data from Hacker News

Logging sucks

loggingsucks.com

211–220 of 232 posts

Re: Logging sucks

#211
post #100

Earlier quoted context omitted.

> If a user request is hitting that many things, in my view, that is a deeply broken architecture. Things can add up quickly. I wouldn't be surprised if some requests touch a lot of bases. Here's an example: a user wants to start renting a bike from your public bike sharing service, using the app on their phone. This could be an app developed by the bike sharing company itself, or a 3rd party app that bundles mobilit…

This was an excellent explanation of a complex business problem, which would be made far more complex by splitting these out into separate services. Every single 'if' branch you describe could either be a line of code, or a service boundary, which has all the complexity you describe, in addition to the added complexity of: a. managing an external API+schema for each service b. managing changes to each service, for ex…

That's a good summary of the immediate drawbacks of putting network calls between different parts of the system. You're also right to point out that I gave no good reason why you might want to to incur this overhead.

So what's the point?

I think the missing ingredient is scale: how much are you doing, and maybe also how quickly you got where you are.

The system does a lot, even once in place, there's enough depth and surface to your business and operational concerns that something is always changing. You're going to need people to build, extend and maintain it. You will have multiple teams specializing in different parts of the system. Your monolith is carved into team territories, which are subdivided into quasi-autinomous regions with well-defined boundaries and interfaces.

Having separate services for different regions buys you flexibility in the chosen implementation language. This makes it easier to hire competent people, especially initially, when you need seasoned domain experts to get things started. It also matters later, where you may find it easier to find people to work on your glue code parts of the system, where you may be more relaxed about language choice.

Being able to deploy and scale parts of your service separately can also be a benefit. As I said, things are busy, people check in a lot of code. Not having to redeploy and reinitialize the whole world every few minutes, just because some minor thing changed somewhere is good. Not bringing everything down when inevitably something breaks it also nice. You need some critical parts to be there; but a lot of your system can be gone for a while no problem. Don't let those expendables take down your critical stuff. (Yes, failure modes shift; but there's a difference between having a priority 1 outage every day, or much less frequently. That difference is also measured in developer health.)

About the databases: some of your data is big enough that you don't want to use joins anyway. They have a way of suddenly killing db performance. Those who absolutely need it are on DynamoDb. Some others are still okay with a big Postgres instances, where the large tables are a little bit denormalized. (BI want to do tons of joins, but they sit on their separate lake of data.) There's a lot of small fry that's locally very connected, and has some passing knowledge of the existence some big, important business object, but crucially not its insides. If you get a new business concern, hopefully you cut your services and data around natural business domains, or you will need to do more engineering now. Just like in your monolith, you don't want any code to be able to join any two tables, because that would mean that things are to messy to reason about the system anymore. Mind your foreign keys! In any case, if you need DynamoDb, you'll be facing similar problems in your monolith.

A nice side effect of separate services is that the resist an intermingling of concerns that must be prevented actively in monoliths. People love reaching into things they shouldn't. But that's a small upside against the many disadvantages.

Another small mitigating factor is that a lot of your services will be IO bound and make network requests anyway to perform their functions, the kind that makes the latency from your internal network hop much less of a trade-off.

It's all a trade-off. Don't spin off a service until you know why, and until you have a pretty good idea where to make a cut that's a good balance of contained complexity vs surface area.

Now, do you really need 15 different services? Probably not. But I could see how they could work together well, each of them taking care of some well-defined part of your business domain. There's enough meat there that I would not call things a mistake without a closer look.

This us by no means the only way to do things. All I wanted is show that it can be a reasonable way. I hope there's more reason now.

As for the logging problem: it's not hard to have a standard way to hand around request ids from your gateway, to be put in structured logs.

Re: Logging sucks

#212

Earlier quoted context omitted.

> It matters to me, because I don’t want to be dependent on a sync ack between two fault domains for 99.999% of my logs. I only care about this when the regulator says I must. If you want synchronous replication across fault domains for a specific subset of logs, that’s your choice. My point is that treating them this way doesn’t make them not logs. They’re still logs. I feel like we’re largely in violent agreement,…

> I suspect you’re overengineering to meet an overly stringent interpretation of a requirement. Which regimes, specifically, dictated that you must have synchronous replication across fault domains, and for which set of data? As an attorney as well as a reliability engineer, I would love to see the details. I can’t go into details about current cases with my current employer, unfortunately. Ultimately, the requiremen…

> have you never been asked to ensure data cannot be lost in the event of a catastrophe? Do you agree that this requires synchronous external replication?

I have been asked this, yes. But when I tell them what the cost would be to implement synchronous replication in terms of resources, performance, and availability, they usually change their minds and decide not to go that route.

Re: Logging sucks

#213
post #81

Earlier quoted context omitted.

…and the same ID can be displayed to user on HTTP 500 with the support contact, making life of everyone much easier.

I have seen pushback on this kind of behavior because "users don't like error codes" or other such nonsense. UX and Product like to pretend nothing will ever break, and when it does they want some funny little image, not useful output. A good compromise is to log whenever a user would see the error code, and treat those events with very high priority.

> UX and Product like to pretend nothing will ever break, and when it does they want some funny little image, not useful output.

Just ignore them or provide appeasement insofar that it doesn’t mess with your ability to maintain the system.

  (cat picture or something)
  
  Oh no, something went wrong.
  
  Please don’t hesitate to reach out to our support: (details)
  This code will better help us understand what happened: (request or trace ID)

Re: Logging sucks

#214

> No grep-ing. How is grep a bad thing? I find myself using it all the time. I’m not into graphical user interfaces. They overwhelm me. By the time I’ve clicked myself through the GUI or written some horrible proprietary $COMPANY Query Language string, I might have already figured out the bug using tried and tested CLI tools.

Me neither. When I deal with structured logs, I use Structured Query Language, typically with ClickHouse or DuckDB which are CLI tools too.

grep is all right, but sometimes I need to tease out a complex data relationship.

Re: Logging sucks

#215
post #192

While I agree with some of it, I feel like there's a big gotcha here that isn't addressed. Having 1 single wide event, at the end of a request, means that if something unexpected happens in the middle (stack overflow, some bug that throws an error that bypasses your logging system, lambda times out etc...) you don't get any visibility into what happens. You also most likely lose out on a lot of logging frameworks you…

I wonder if one might solve this by using an accumulator that merges objects as they are emitted based on some ID (i.e. request ID say) and then ether emits the object on normal execution or a global exception handler emits it on error...?

I was going to say that. That definitely would be a solution (and ought to be the way it works).

Re: Logging sucks

#216
post #177

Earlier quoted context omitted.

Really, have sane log message types and include ”audit” as one of them. Log levels could be considered an anti-pattern.

I like this. But doesn't it make sense to categorize en Exception thrown as an erro somehow? And a new user registration as an email info? Perhaps use tags then?

Some kind of ”Error” is of course one of the sane message types. ”Warning” and ”info” might be as well.

”Verbose”, ”debug”, ”trace” and ”silly” are definitely not, as those describe a different thing altogether, and would probably be better instrumented through something like the npm ”debug” package.

Re: Logging sucks

#217

Earlier quoted context omitted.

Compared to human bad writing, AI writing tends to suck more verbosely and in exciting new ways (e.g. by introducing factual errors).

> AI writing tends to suck more verbosely So, it's the style you oppose, the way a grammar nazi complains about "improper" English > and in exciting new ways (e.g. by introducing factual errors). Because factually incorrect comments didn't exist before AI? Your concern is that you read something you don't like, so you pick the lowest-effort criteria to complain about. Speaks more about you than the original commenter…

I'm pretty sure by verbose it's the realization you've wasted precious time reading AI bloat that you'll never get back. On top of that, now you need to reread the text for hallucinations or just take a loss and ignore any conclusions at risk that they came from bad data.

Re: Logging sucks

#218

The presentation is fantastic and I loved the interactive examples! Too bad that all of this effort is spent arguing something which can be summarised as "add structured tags to your logs" Generally speaking my biggest gripe with wide logs (and other "innovative" solutions to logging) is that whatever perceived benefit you argue for doesn't justify the increased complexity and loss of readability. We're throwing away…

Do you really loose the ability to grep? You can still search for json fragments `grep '"uid": "user-123"' application.log` If the json logged isn't pretty printed everything should still be on one line. You can also grep with the `--context` flag to get more surrounding lines.

It's not even that bad.

As long as it's actual json, it doesn't matter if it's pretty-printed or not, since `jq` can fold and unfold it at will.

I frequently fold logs into single lines, grep for something, then unfold them again

Re: Logging sucks

#219
post #57

Horrid advice at the end about logging every error, exception, slow request, etc if you are sampling healthy requests. Taking slow requests as an example, a dependency gets slower and now your log volume suddenly goes up 100x. Can your service handle that? Are you causing a cascading outage due to increased log volumes? Recovery is easier if your service is doing the same or less work in a degraded state. Increasing…

I do not see how logging could bottleneck you in a degraded state unless your logging is terribly inefficient. A properly designed logging system can record on the order of 100 million logs per second per core. Are you actually contemplating handling 10 million requests per second per core that are failing?

Damn that's fast! I'm gonna stick my business logic in there instead.
Post reply on HN